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ABSTRACT 

We  consider  the  problem  of  a  rogue  introducing  bias  into 
a  network  estimating  location  under  the  time  difference  of 
arrival  (TDOA)  method.  In  particular  we  consider  how  a 
rogue  by  injecting  only  a  single  false  sensor  position  can 
drive  the  network’s  location  estimate  a  specified  distance 
away  from  the  true  value.  The  least  squares  (LS)  residuals  is 
minimized  to  find  the  false  location  to  inject  given  the  rogue’s 
desired  distance  offset.  In  order  to  illustrate  the  success  of 
our  method,  we  consider  the  statistical  tools  that  the  locating 
network  might  employ  to  handle  our  false  information  injec¬ 
tion  including  least  squares  and  in  the  presence  of  outliers 
robust  least  median  squares  (LMS).  We  show  that  our  method 
can  successfully  bias  the  location  estimate  of  an  estimating 
network  when  both  LS  and  LMS  methods  are  used. 

Index  Terms —  Emitter  location,  TDOA,  non-linear  least 
squares,  information  injection 

1.  INTRODUCTION 

Sensor  networks  communicate  using  a  shared  wireless  medium, 
and  thus  it  is  possible  for  a  rogue  sensor  to  infiltrate  the  net¬ 
work.  Although  methods  exist  for  securing  sensor  networks 
(i.e.,  encryption),  such  unauthorized  access  can  still  occur 
[1],  Thus,  it  is  important  to  understand  how  a  rogue  can 
degrade  estimation  accuracy  as  well  as  how  a  sensor  network 
can  mitigate  its  effect. 

One  sensor  network  estimation  task  of  particular  interest 
is  estimating  the  location  of  an  emitter.  We  consider  the  prob¬ 
lem  of  a  rogue  introducing  bias  into  a  locating  network  using 
time  difference  of  arrival  (TDOA).  We  assume  a  rogue  sensor 
can  inject  a  false  report  of  its  state  (e.g.  sensor  position  and 
velocity)  into  an  estimating  network.  In  particular,  this  work 
seeks  the  false  sensor  location  which  drives  the  emitter  loca¬ 
tion  estimate  a  specified  distance  away  from  its  true  value. 

The  problem  of  decreasing  the  accuracy  of  localization 
networks  has  been  previously  considered  in  [2,  3,  4],  In  [2],  a 
bias  is  introduced  into  triangulation  through  a  simple  corrup¬ 
tion  model  where  the  adversary  arbitrarily  alters  a  percentage 
of  measurements  such  that  they  vote  for  some  other  location. 
In  order  to  obtain  a  consensus,  many  measurements  are  re- 
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quired.  Alternatively  in  [3,  4]  a  single  false  location  injec¬ 
tion  is  used  to  decrease  estimation  accuracy  by  minimizing 
the  Fisher  Information  Matrix  (FIM).  Here  and  in  [3,  4]  we 
assume  that  a  single  rogue  sensor  deceitfully  pairs  with  one 
valid  sensor  thereby  corrupting  a  single  sensor  pair.  The  other 
M—l  pairs  each  contain  two  valid  sensors.  While  [4]  shows 
that  it  is  possible  to  maximally  degrade  estimation  accuracy 
via  a  single  injection,  as  will  be  shown  in  Section  3.1,  mini¬ 
mizing  the  FIM  does  not  necessarily  introduce  a  bias. 

This  work  solves  a  different  problem,  where  in  order  to 
drive  the  emitter  location  estimate  away  from  its  true  value 
we  minimize  the  LS  cost  of  the  TDOA  residuals  to  determine 
the  false  sensor  location  to  be  injected.  The  main  contribu¬ 
tions  of  this  work  are:  (1)  a  method  by  which  a  rogue  can 
introduce  a  significant  bias  into  the  location  estimate  of  an  es¬ 
timating  network  under  TDOA,  and  (2)  the  bias  achieved  by 
the  rogue  can  be  intuitively  controlled  through  a  distance  pa¬ 
rameter.  Through  numerical  results  we  show  that  our  method 
is  able  to  introduce  significant  bias  even  in  the  presence  of 
robust  estimation  techniques. 

Section  2  discusses  estimation  under  TDOA.  Section  3 
presents  a  new  method  of  finding  the  false  rogue  position  that 
introduces  significant  bias.  Section  4  evaluates  the  success  of 
the  rogue  using  mean  squared  error  (MSE)  for  both  the  non¬ 
linear  LS  and  more  robust  least  median  squares  (LMS). 

2.  BACKGROUND 

A  collection  of  N  sensors  is  used  to  estimate  the  location  of 
a  stationary  emitter  located  at  xe.  In  a  two-dimensional  sce¬ 
nario  at  least  two  pairs  of  sensors  are  needed  under  the  time 
difference  of  arrival  (TDOA)  method  to  obtain  a  location  es¬ 
timate.  The  sensors  are  paired  apriori  into  M  =  Y  pairs  and 
no  two  pairs  share  a  common  sensor.  Each  pair  of  sensors  de¬ 
fines  a  hyperbola  where  the  foci  are  the  sensor  locations  [5], 
The  actual  TDOA  of  the  mth  sensor  pair  is 

Tm  (Xe)  =  -  (||xe  -  X»||  -  |  |xe  -  Xjll)  ,  (1) 

where  x.(,  x;  are  the  locations  of  sensors  i  and  j  of  the  mth 
pair,  and  c  is  the  speed  of  light. 

Each  sensor  pair  makes  their  TDOA  estimate,  fm,  by 
cross  correlating  their  measured  signal  data.  All  estimated 
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TDOAs  are  sent  to  a  single  node  for  location  processing 
which  is  assumed  here  to  not  be  the  rogue  sensor.  The  mea¬ 
surements  are  corrupted  by  additive  estimation  errors 

Tm  =  Tm  (xe)  +  7lm  TO  =  1,  .  .  .  ,  M,  (2) 

where  nm  is  the  mth  pair’s  random  TDOA  measurement  er¬ 
ror.  The  TDOA  measurements  are  obtained  using  the  maxi¬ 
mum  likelihood  (ML)  estimator.  From  the  asymptotic  prop¬ 
erties  of  the  ML  estimator  [6],  the  distribution  of  nm  is  taken 
as  zero-mean  Gaussian  with  variance  a2n  for  to  =  1, ...,  M. 

Using  the  TDOA  measurements,  the  location  estimate  can 
be  found  by  minimizing  the  least  squares  (LS)  cost  of  the 
TDOA  residuals  given  by 


■  ■  ■  circle 
O  true  emitter  location 
vector  [x  -  u] 

X  circle-line  solution 
- sensor  pairings 


50  100  150 


M 

xe  =  arg  min  ^  (fm  -  rm  (xe))2  (3) 

Xe  m= 1 

where  xe  is  the  variable  of  all  possible  emitter  locations. 
Due  to  the  non-linear  dependency  on  xe,  the  Gauss-Newton 
method  [6]  can  be  used  to  iteratively  find  the  LS  solution. 
Since  non-linear  LS  is  typically  used  to  estimate  location  [5], 
it  is  important  to  understand  how  the  non-linear  LS  estimate 
can  be  influenced  by  a  rogue’s  false  injection. 

3.  IMPACT  OF  THE  ROGUE  SENSOR 

In  [4]  we  considered  a  rogue  that  seeks  to  maximally  degrade 
accuracy  by  choosing  its  false  state  to  minimize  the  Fisher 
Information  Matrix  (FIM).  In  this  section  we  first  show  that 
the  rogue’s  choice  of  false  state  in  [4]  degrades  the  location 
to  exactly  the  same  location  estimate  that  would  be  achieved 
if  only  the  M—  1  non-corrupt  sensor  pairs  are  used.  Thus,  we 
show  the  strategy  in  [4]  only  degrades  accuracy  by  increasing 
the  variance  and  does  not  introduce  any  bias  into  the  location 
estimate  as  shown  in  Figure  1.  We  precisely  determine  the 
impact  of  the  solution  in  [4]  on  the  non-linear  LS  estimate 
and  introduce  a  new  method  capable  of  introducing  signifi¬ 
cant  bias  into  the  estimate. 

3.1.  Interpretation  of  the  FIM  Minimizing  Solution 

In  [3, 4]  a  single  rogue  sensor  is  used  to  inject  a  false  state  into 
the  network  to  minimize  the  FIM.  The  closed  form  solution 
in  [4]  is  given  by 

X/~Xe  =  X«~Xe  (4) 

llX/-Xe||  |  |xi  xe  1 1 

where  x^  is  the  false  state  and  xt  is  the  true  sensor  in  the 
corrupt  pair.  The  result  in  (4)  states  that  the  false  position 
lies  along  the  vector  from  the  emitter  through  the  true  sen¬ 
sor.  If  a  locating  network  is  assumed  to  be  able  to  detect 
and  reject  erroneous  TDOA  measurements  then  care  should 
be  taken  when  choosing  a  position  on  the  line  (4).  To  avoid 


(a)  System  setup 


(b)  Performance  comparison  of  M  and  (M— 1)  pairs 


Fig.  1.  Impact  of  the  rogue  using  the  solution  in  [4]. 

detection,  the  sensor  position  that  does  not  change  the  TDOA 
value  of  the  corrupted  pair  should  be  selected.  This  position 
is  at  the  same  distance  from  the  emitter  as  the  actual  position 
of  the  sensor. 

We  now  provide  further  insight  into  the  impact  of  the 
choice  of  false  state.  Namely,  the  solution  in  [4]  is  equiva¬ 
lent  to  only  using  the  non-corrupt  pairs  to  perform  the  emitter 
location.  This  can  be  seen  by  examining  the  non-linear  LS 
estimate  update  [6]  given  by 

0k+i=0k  +  (  H^Hefc)_1H^r,  (5) 

where  6  is  the  unknown  parameter  (emitter  location),  the  Ja¬ 
cobian,  Hgk  is  the  derivative  of  TDOA  w.r.t.  the  emitter’s  lo¬ 
cation  given  that  the  kth  estimate  is  correct,  and  r  is  the  resid¬ 
ual  TDOA  given  the  kth  estimate.  For  M  sensor  pairs,  the  Ja¬ 
cobian  is  (dropping  the  subscript)  H  =  [hf ; . . . ;  h^] 

where  hm  is  the  derivative  of  TDOA  of  the  rnfh  pair  w.r.t. 
the  emitter’s  location  and  hjn  is  the  mth  row  of  H.  The 
product  HtH  can  be  written  as  the  sum  of  each  pair’s  con- 
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tribution,  HTH  =  hihf  +  ^2^2  +  •••  +  hMh where 
we  assume  that  the  last  pair  M  contains  the  corrupt  rogue 
sensor  and  from  [4],  hjf  =  01X2.  The  Jacobian  becomes 
H  =  [h^ ; . . . ;  h^f  l;  0lx2]  and  the  product  HTH  becomes 

HtH  =  hihf  +  h2h^  4 - b  hj M-ih^  +02x2  (6) 

' - V - ' 

due  to  non-corrupt  pairs 

indicating  that  the  non-linear  LS  estimate  is  computed  using 
only  the  non-corrupt  pairs’  Jacobian  submatrices.  Thus,  the 
solution  in  [4]  can  increase  the  variance  no  more  than  to  the 
level  that  would  occur  if  only  the  M— 1  non-corrupt  pairs  are 
used  for  location  processing  as  shown  in  Figure  1 .  In  many 
cases  this  prohibits  the  rogue  from  significantly  degrading  the 
performance,  i.e.,  for  cases  where  the  performance  with  the 
remaining  M— 1  pairs  is  sufficiently  good.  It  also  leaves  some 
random  aspect  to  the  degradation  achieved  -  even  though  the 
variance  is  larger,  a  particular  estimate  may  be  quite  accurate. 
Next  we  explore  a  new  approach,  which  does  not  have  this 
limitation  and  allows  for  the  rogue  to  introduce  significant 
bias  into  the  location  estimate. 


where  fm  ( 9 )  and  fM  (9,  x/)  are  the  TDOA  values  for  the 
possible  values  of  xy  and  9,  and  rm  is  the  true  value  of  TDOA 
of  the  mth  pair  in  (1).  For  simplicity  of  notation  we  drop  the 
functional  dependence  of  the  TDOAs  on  xe  r  ( 9 )  to  9  noting 
that  all  parameters  in  (7)  except  9  are  known. 

The  problem  in  (8)  is  non-linear  and  due  to  the  rank  defi¬ 
ciency  of  the  Jacobian  matrix  the  Gauss-Newton  method  can¬ 
not  be  used.  The  Jacobian  is  given  by 


H 


d-n_(6>)  dTi(fl) 

dO  <9x/ 


drM{0^f)  drM{0^f) 

80  dxf 


(9) 


where  dT^P  =  01X2  Vto  ^  M.  The  Jacobian  is  Mx3  and  is 
clearly  rank  degenerate.  To  remedy  this  problem  a  change  of 
variables  can  be  used  where  Rf  =  ||xejT.  (9)  —  xy 1 1 .  The  LS 
cost  in  (8)  can  be  re-written  as 


arg  min 
Rf,e 


M- 1 

yi  (fm  (#)  -  Tm)2  +  (fM  (0,  Rf) 

m=  1 


Tm)2  (10) 


3.2.  Biasing  the  Location  Estimate 

The  goal  of  the  rogue  is  to  drive  the  non-linear  LS  estimate 
of  emitter  location  to  be  r  distance  units  away  from  its  true 
value  by  injecting  a  single  false  position.  That  is,  the  rogue 
seeks  to  move  the  non-linear  LS  estimate  to  the  position 

xe,r  ( 9 )  =  xe  +  r  [cos  ( 9 )  sin  (0)]  ,T  (7) 

where  r  is  the  desired  offset  and  9  is  any  value  in  [0,  27r] 
to  be  selected  by  the  rogue  as  shown  by  the  dashed  circle  in 
Figure  2.  Since  the  rogue  allows  the  location  estimate  to  be  at 
any  value  of  9,  it  must  also  be  considered  in  the  optimization. 


Rogue  desired 
emitter  location 


Fig.  2.  Rogue  desired  emitter  location  estimate 

To  find  the  false  position,  the  LS  cost  of  the  TDOA  resid¬ 
uals  is  minimized  given  the  rogue’s  desired  condition  in  (7). 
The  problem  can  be  formulated  as 

M—l 

arg  min  Y (Tm(xeir(6»))-rm)2+(rM  (xe, ,.(#), x/)-rM)2  (8) 
xf’8  m=  1 


where  fM  ( 9 ,  Rf)  =  -  [||xejI.  ( 9 )  —  xt||—  Rf],  By  minimiz¬ 
ing  the  LS  cost  the  rogue  can  reduce  its  detectability.  If  the 
rogue’s  false  state  significantly  increases  the  LS  sum  beyond 
expected  then  its  presence  can  be  detected.  As  such,  the  rogue 
seeks  to  ensure  this  sum  of  squares  is  minimized  while  still 
driving  the  estimate  away  from  its  true  value.  The  set  of  false 
positions  which  minimize  the  LS  cost  (10)  is  described  by  a 
circle  with  center  xe  r  {9)  \g=g *  and  radius  R*j  as  shown  in 
Figure  2.  As  a  result,  any  point  on  this  circle  reported  to  the 
locating  network’s  non-linear  LS  algorithm  is  a  solution  for 
the  rogue’s  false  position. 

The  solution  of  (10)  is  found  by  evaluating  over  a  fine 
grid,  although  it  is  expected  that  this  could  be  solved  using 
other  methods  such  as  gradient-based  methods,  or  using  par¬ 
ticle  swarm  optimization  techniques. 

4.  EVALUATING  THE  FALSE  INJECTION 

We  assume  that  the  rogue  selects  the  false  sensor  location 
to  inject  as  in  Section  3  and  then  reports  the  location  to 
the  estimating  network.  Our  method  is  evaluated  for  an  es¬ 
timating  network  that  uses  both  traditional  non-linear  LS 
and  robust  LS  techniques  to  obtain  its  final  location  esti¬ 
mates  x6iLS  and  xe,LMs-  Recall,  the  LS  estimate  is  given  by 
xe  =  arg  min  J2m= 1  (a™  “  T m  (xe))2,  and  can  be  solved 

Xe 

iteratively  using  Gauss  Newton. 

It  is  well  known  that  LS  estimation  is  susceptible  to  out¬ 
liers.  A  natural  consideration  is  the  use  of  robust  statistical 
techniques  [7]  to  remove  the  sensitivity  to  outliers.  To  this 
end,  it  is  important  to  also  evaluate  the  impact  of  our  ap¬ 
proach  when  robust  statistical  methods  are  used.  Specifically, 
we  evaluate  our  method  against  least  median  squares  (LMS). 
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(a)  Noise  free  (b)  SNR=20dB  (c)  SNR=15dB 

Fig.  3.  Mean  squared  error  performance  for  non-linear  LS  and  LMS. 


The  performance  of  LMS  has  been  shown  in  [8].  Al¬ 
though  no  closed  form  exists  for  LMS,  [9]  provides  an  ef¬ 
ficient  method.  There  are  two  main  steps,  (1)  clustering  the 
measurements  into  subsets  to  obtain  a  set  of  weights,  and  (2) 
reweighting  the  measurements  and  solving  for  the  final  esti¬ 
mate  using  weighted  LS. 

Given  X  total  measurements,  K  subsets  are  randomly 
chosen,  each  with  n  samples.  For  each  subset  j  an  estimate 
Qj  is  found  and  the  squared  residuals  rf:j  for  each  estimate  is 
determined  across  all  X  measurements  .  The  cluster  with  the 
smallest  median  of  the  squared  residuals  is  used  to  determine 
the  weights  for  each  measurement, 

»<  =  {  l  dUJiJe  <“> 


where  sa  =  1.48826^1  +  x^_pJ  y' med,rf  ( 'Sj ,  P  is  the  dimen¬ 
sion  of  the  unknown  parameter,  and  7  is  a  threshold  chosen 
as  in  [9].  Given  these  weights,  weighted  LS  is  then  used  to 
find  the  final  location  estimate. 

The  effectiveness  of  our  approach  in  biasing  the  location 
estimate  is  evaluated  as  a  function  of  MSE  and  the  rogue 
desired  offset.  We  consider  2000  sensor-emitter  geometries 
randomly  generated  in  a  1 000m  x  1000m  field  for  ten  sensor 
pairs. 

Figure  3  shows  the  MSE  of  the  estimate  in  the  presence 
of  false  injection  under  non-linear  LS  and  LMS  for  varying 
SNR.  The  baseline  MSE  without  injection  is  shown  for  com¬ 
parison.  We  observe  that  our  method  is  able  to  successfully 
bias  the  location  estimate  across  varying  distances  and  SNR 
for  both  LS  and  LMS.  For  higher  SNR,  LMS  gives  a  smaller 
error  than  compared  with  LS  as  expected.  For  lower  SNR 
and  small  distance  offsets  LS  gives  a  smaller  error,  while  for 
larger  distances  LMS  gives  a  smaller  error  which  is  to  be  ex¬ 
pected  [2].  For  LS,  increasing  the  distance  offset  increases 
the  MSE  while  for  LMS  the  MSE  still  increases  but  levels  out 
quickly  with  larger  distances. 


5.  CONCLUSION 

In  this  work,  we  consider  the  problem  of  a  rogue  sensor  that 
seeks  to  drive  the  emitter  location  estimate  away  from  its  true 
value.  In  order  to  more  seriously  degrade  performance,  the 
LS  cost  is  minimized  given  the  condition  of  the  rogue’s  de¬ 
sired  offset.  Our  method  introduces  significant  bias  into  the 
estimate  for  a  network  employing  non-linear  LS  and  even 
when  robust  estimation  methods  such  as  LMS  are  used. 
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